AppSec California 2015
who it's for
application security engineers, security managers, web developers, devops engineers, mobile security engineers, penetration testers, security researchers, security architects
topics
.NET reversing and exploitation; iOS mobileconfig attacks; unicode handling vulnerabilities; content security policy deployment; http security headers; OWASP Proactive Controls; continuous delivery security checks; Node.js application security; POS ram scraping malware; IoT PKI and device security; SQL Server configuration hardening; password manager leakage attacks
| title | author | length |
|---|---|---|
| AppSec is Eating Security | Alex Stamos | 01h 06m |
Claim: application security dominates the next 20 years because software is eating the world and most companies are unprepared — roughly 100 of the Fortune 500… | ||
| Leveling up an application security program | David Rook | 56m |
Over a first year at Riot Games the application security program moves from invisibility to measurable practice: a 15‑question design checklist and secure… | ||
| Node.js application (in)security | Ilja van Sprundel | 47m |
Claims concrete failures and fixes: server-side eval → remote JS execution is present in real GitHub examples and allows arbitrary code; use child_process… | ||
| Hacking Management | Adam Brand | 19m |
Claims a repeatable three‑step method: do Recon, Empathize, Enable Change by mapping formal and informal decision paths, timing requests to budget cycles and… | ||
| Modern Malvertising ... | Arian Evans | 55m |
Breaks down actual findings: a measured top‑5 list shows monetization vectors dominate—fake branded updates, generic trojans and fake AV far outnumber exploit… | ||
| Bounties and the SDLC | Katie Moussouris | 56m |
A case study shows a 30-day IE11 beta bounty that produces 23 submissions 18 bulletin-class 4 sandbox-escapes and leads engineers to change testing and ship… | ||
| I Hate Infosec | Charlie Miller | 57m |
Argues that infosec shows little net improvement since 2007 with concrete evidence: old classes of bugs still dominate, an X server bug from 1991 sat… | ||
| Marshalling Pickles | Chris Frohoff, Gabriel Lawrence | 51m |
Deserializing objects in Python, Ruby and Java lets attackers turn session blobs and view state into remote code execution by stuffing crafted object… | ||
| Hackazon: Stop hacking like its 1999 | Dan Kuykendall | 55m |
Hackazon claims to replace old Web 1.0 test apps with a modern vulnerable web application: a faux storefront plus a companion mobile app that talks to RESTful… | ||
| .NET Reversing and Exploitation for Cool Kids | Kelly Lum | 50m |
Covers practical .NET reversing and exploitation with concrete examples: uses Reflector, CFF Explorer and a hex editor to decompile and edit assemblies… | ||
| Malicious MDM: Fun with iOS MobileConfigs | Karl Fosaaen | 23m |
A live demo deploys malicious .mobileconfig profiles via USB, QR/URL and phishing to push Wi‑Fi, VPN, proxy, web clips and a root CA to iOS devices; the… | ||
| Unicodes Gone Wild | Christien Rioux, DilDog | 54m |
Explains concrete Unicode failures and measurements: notes 86.4% of web pages use UTF-8, demonstrates differences between UTF-8/16/32 and how Python/Ruby… | ||
| API = Authentication’s Poorly Implemented | Zach Lanier | 39m |
Real examples and fixes matter: a PayPal 2FA bypass arises from a legacy SOAP endpoint accepting primary credentials while the REST API enforces TFA, a… | ||
| DevOps for the Discouraged | James Wickett | 59m |
Shows a working continuous delivery pipeline that runs security checks inside CI (Travis and Jenkins examples), wraps attack tools with gauntlt, and scripts… | ||
| Fix The Damned Software | John Steven | 50m |
Claims that testing alone just piles up bugs and that security must be built into frameworks and platforms backed by BSIMM and assessment data. Finds a 67%… | ||
| Devil in the Haystack | Ping Yan | 52m |
Claims a data‑driven, in‑app anomaly system that uses Apache Spark on Hadoop to profile millions of users with unsupervised online learning and sequence +… | ||
| The Emperor’s New Password Manager | Devdatta Akhawe | 24m |
Analyzes five real web‑based password managers and demonstrates practical exploits: four out of five leak credentials under attack, with concrete case studies… | ||
| Anatomy of ... POS Malware | Amol Sarwate | 57m |
Demonstrates that RAM scraping malware actually elevates privileges (uses seDebugPrivilege), opens the POS process and dumps committed pages with… | ||
| We All Know What You Did Last Summer | Ken Westin | 31m |
Demonstrates concrete techniques and outcomes: a laptop software that snaps webcam and Wi‑Fi geolocation and USB payloads that phone home, a firmware‑level USB… | ||
| Fixing XSS with Content Security Policy | Ksenia Dmitrieva | 58m |
Explains how Content Security Policy actually blocks injected script by enforcing allowed sources and by using nonce and hash directives to permit only known… | ||
| No Better ROI: HTTP Headers for Security | Caleb Queern | 26m |
A fast checklist of what actually moves risk: a scanner (securityheaders.com) crawling the Alexa top 100,000 shows a median score of 2 out of 10, so adoption… | ||
| OWASP Top Ten Proactive Controls | Jim Manico | 53m |
Gives concrete fixes: use parameterize queries to eliminate SQL injection, encode output per context with the OWASP Java encoder or antixss, and sanitize… | ||
| Wi-Fi Hacking for Web Pentesters | Greg Foss | 52m |
Clones of real captive portals (not just a concept) get built and deployed, capturing ISP logins from XFINITY Wi‑Fi and hotel hotspots; tools actually used… | ||
| Making SSL Warnings Work | Adrienne Porter Felt | 52m |
Chrome instruments real errors and targets fixes not handwavy examples: browser detects client clocks cause ~20% of HSTS errors, shows a date‑settings flow… | ||
| 10 Deadly Sins of SQL Server Configuration | Scott Sutherland | 54m |
Starts with concrete failures and tools not fuzzy topics: default sa or sysadmin service accounts in connection strings, service accounts running as… | ||
| Medical Device Security | Scott Erven | 58m |
Three years of research shows hundreds of medical devices and thousands of healthcare systems exposed to direct attack vectors, with scans via Shodan revealing… | ||
| When Geo goes Wrong | Colby Moore | 35m |
Research reverse engineers Grindr protocol via a MitM proxy because of no SSL pinning, reads JSON blobs that include subcentimeter or ~3 m relative distances… | ||
| Proactively defending your business | Cassio Goldschmidt, Jim Manico | 59m |
Describes concrete failures and fixes: real incidents (Heartbleed, GoToFail, TurkTrust and the French CA), measurable user behavior (30–70% click through… | ||
| Scaling Security in Agile Scrum | Chris Eng | 54m |
Case study claims a working process for ~ten Scrum teams that shifts security earlier into backlog grooming and hands routine checks to embedded security… | ||
| Legacy Java Vulnerabilities | Jonathan Gohstand | 49m |
Shows a modified JVM that containerizes legacy Java apps so multiple old JREs run on one modern host JVM, with run multiple legacy JVMs on one host and no app… | ||
| Why Your AppSec Experts Are Killing You | Jeff Williams | 59m |
Argues that expert-led AppSec is a bottleneck and gives a concrete alternative: define an expected security model, deploy instrumentation-based testing… | ||
| IoT: Taking PKI Where No PKI Has Gone Before | Scott Rea | 56m |
Claim: PKI crypto alone does not produce trust; policies, liability and operational processes must accompany keys. Demonstrations: web PKI mechanics, grid… | ||
| SQLViking: Pillaging your Data | Jonn Callahan, Ken Toler | 36m |
A small open source tool called SQLViking passively logs SQL queries and result sets with a scout component and actively injects arbitrary SQL via TCP… | ||
| Uncovering OWASP’s Mobile Risks in iOS Apps | Patrick Wardle | 58m |
Shows concrete steps and results: uses AppleScript to automate iTunes download (about 10–15 lines), jailbroken-device techniques to extract unencrypted binary… | ||
| Building a Modern Security Engineering Organization | Zane Lackey | 57m |
Describes concrete practices: migrating AppSec to continuous deployment at Etsy scale with feature flags and production ramping, building visible dashboards… | ||
| Caspr and Friends | Stuart Larsen | 51m |
Caspr is an open source Heroku-hosted service that collects and normalizes CSP reports and aggregates duplicates into groups, uses those JSON violation reports… | ||
| How Building a Better Hacker Accidentally Built a Better Defender | Casey Ellis | 56m |
Claims that a crowdsourced program turns offensive skill into defensive improvement get tested with numbers and stories: a Bugcrowd platform with 145,000… | ||
| Securing Software’s Future | Timothy D. Morgan | 48m |
Claims that changing APIs reduces whole classes of bugs with little developer training, supported by examples: LDAP filter injection persists because… | ||
| nothing matches | ||